e6442f63826fe76a37cbb1dc688a8febc57c00362550393cc9a5e75897490bd6

Analysis

max time kernel
119s
max time network
158s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72ce3623a9fb8a1d30f7822a51d4a051.html
Size

11KB
MD5

72ce3623a9fb8a1d30f7822a51d4a051
SHA1

4c05c21ef052853413dc7856be91519e8096a776
SHA256

e6442f63826fe76a37cbb1dc688a8febc57c00362550393cc9a5e75897490bd6
SHA512

7936047c799f873b87bd7a20690db36885b99457cbb9737038b2be1025901a443f5a885daace7b81c7323058039d5aae6a734eaf0f5aaf986b6b7823205ed454
SSDEEP

96:uzVs+ux7zYtLLY1k9o84d12ef7CSTUWj3OlpKIoB9bRcEZ7ru7f:csz7zYtAYS/eQzb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409884559"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b02741682339da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000055d48c1a636e400efcdb83e9fa21b97e3fa280abf64a7a9ca0fba9c0d779ff72000000000e80000000020000200000005117a904c6838957dd8842b1eeba2dcd2d1c2961ef005f9ce06b80b9c9fde54720000000a82350a5faadd3405aa88e643cd0327ff524cff69a405f8cd1b55fbacf55039d4000000032cc2b8a91fcc809d00234806c4ed2115403c565eb8cf9b27e8be3d84b8376979c481e4d278f4657c5b4c3b19306ee223d4ce14b79f8b4214b2df37b32403b1f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{917A3951-A516-11EE-B93A-6E3D54FB2439} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000fa16ce23fe4cd0d57b9a1f8f72d0e8948c596152b8b91380b0cdc3bd0ce1c926000000000e800000000200002000000056a25c677e8804b5e45f06527e4d532068a69b644860527426f3e1f45840905790000000c27f098c8f294834a5c94166b91eede6ca8d58dee33a8bd4423006c71e2da676583b48eed4d794b7341dfc5590a1c6de39da73ece6d30ba0ebe7bdbb01ad531595c1cb98388e691fabccf0020f55200a0aed6c294ff49611f728e812461ccd7a05751d03587422b8cbd5f6bfda1a20413954757d37f8391de02c174377b01a20c01b65a1554401fc1d8ada5d5201a0b340000000313d5157bb7ce54d11e4367152ce128cd9718a2cfd9670266b1552206f02f949c14f432d88160b25c87454bb99a6496062310e1c6147804c257af81f29a2b86a	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2512	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2512	iexplore.exe
2512	iexplore.exe
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2080	2512	iexplore.exe	28
PID 2512 wrote to memory of 2080	2512	iexplore.exe	28
PID 2512 wrote to memory of 2080	2512	iexplore.exe	28
PID 2512 wrote to memory of 2080	2512	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\72ce3623a9fb8a1d30f7822a51d4a051.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2512 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ff8a09ba5e1a8cf03137e795e431e59

SHA1
c05e1f7b19ef30cee3c28220b25600a2fb1c1f7d

SHA256
da7cce01a31cd7d3618e3a1820f82341af0214a63e2074ec4d46f6ce6ce0780c

SHA512
62898628138cdff8901e6343fa804faf4900f34938df3ea8fd3a870b0f2d6fcab52c19ba71e427d221b2b54d82ec66dc4051f5d13e841d0b39ffa7b920392531

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52f9d8a2f9163ff2541d2441abfc783e

SHA1
e49eabb0c01bcd98427342ab62b9f0d3d9c4158d

SHA256
cb19bdc39ce4524c8d99a779cb9b99daa9875d3fa01f9f608738985665577269

SHA512
cb172ffcaaecd4d4f69d17052f7fbc456ecc211b012d0be61ab576a5ede1ee98d68e9bae714a81813fc0dec9cafbf3b258d62617f996f1f6e69fa638ca4d2cc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ab481951ddacc48741e316e60299367

SHA1
dee14773bfa9726a2e991e35465ee8ec435c2299

SHA256
9f7320f64dbb4788ae08b2ff8dd15576954443363e387186190a5cdab5551441

SHA512
326d7b0a3eb6ba801b5a6ca0ca19ebd26ed3a7fdba9e10b74fd91c114f87ad1f80690c71095c6fbf3cff6cf4499baed51879889cb8901e9fb39d60546aac2503

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d0b3315bdeffdc430d71e8ca9548d14

SHA1
9e70fa72495a2be92b72158e02cbf9158cbd92f1

SHA256
534205649a34e8eafa1e914a7317c3defb44057c840e8e8db9f70679de735a39

SHA512
3f439eecc5cded5b199d60e20b07a6b623b0410f676a10ecb487bf50cee728751bf14cbd04f22117d8e05fbf9c70272a011ccb121e97f462c0597488128e8335

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea2295e4a817134e871aa16f00cab209

SHA1
444d317bc212fb3ad574661f5fe66532cc3e5a20

SHA256
e3dc3bc7e0d2554fd6e9ef91dac33fbfc1cd65f6f3fcbf7d524c996a9bdfc922

SHA512
c51101fb954fe832fdf7ea2880bbad5b7fc2d99634278ea349452caa89a2a8f88ed052c919a1757f8b79079e8279636556106a596741003e843ef97d1df8d08e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d50519797fdc1696b7fbabb61a17b9e9

SHA1
c20d4a8b536237c9f0ae6c9ba836827ec016fd9b

SHA256
b2227ac57704d373da7eb3bcad3cd543b4f8ca1438393aa0dfde71b7cd32e614

SHA512
bcb3754747c2c43b18012f7deb4bc044f942a3cefa4b89accd833cd3989200e7e17ca0a39118aca7544b7234eabdf5bc5c5d31c431df2dab83cc0d24782e7f47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40eae78fccdfc6e8c9c4f1f6e2fc1e79

SHA1
d1d457d1d3dd34df8c8a2764037f57082f80463f

SHA256
01762e60099433bec545f2be0314304b363c1b977ff5e0298fb457b6a5f72a31

SHA512
167c5a83c4524a566efab534d65a40ad3187d162c105c2837d4854be63c85d3297b08df0ee773ebce5761cd709b14eb381fbfe11c86a7c4de64467b9b9df69ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ead547356992704482350512afe717e

SHA1
ae4a5f7d1f3d01d84da2e25aa0dccaeb347181f3

SHA256
5c318a8374f4faa280869337155168e5c8616266e9daff2c7ea801e46f265b08

SHA512
c755b2735b402f30d9f03abce775c3c136cda93c6f2c744c51759192d46f572001ed9c0b3a1388362ebc5daed5f2b4234e734635d1aa379b82ad310ddbef1ebb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a4f83d1cf9feb41e70d6cf586cffde5

SHA1
bf82f857de76e024b163ae549ef7747430e30807

SHA256
b4d08585b00e152e25ef937300bfb307307cff8ed21a6b936fe0e111bf141990

SHA512
73fdd2ccdc879991b17042e907d6142ba1d07f370d2887d1cb6c33946557ebabe6ec4e7d6c18f03f10d8bf2b5506027fdb7deb94f7a571d0480a1769877c6a55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
348ee26e729b2173e5cffa5ef0d28c57

SHA1
dd588456042f4daf591b6b873fbd1b4e96e7aebb

SHA256
3bf6af529559c6a426f0db9a95d78b2619eb02726bf85c2f3a884540b437c9ea

SHA512
07f2fdea4d8ea4e6e729276e233dec6960ee1c0abf0ee72a5fe1233442c519ecac888cf5b5670502a40c3576fea0e911cbbf6a219691b720e5d4c16469e73547

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35fbe083d6b92b6e52cf9c11f8164980

SHA1
47d6d5a252c68f8ed69f57bcb67916f3fec590ec

SHA256
8ec984bfa26d2b15109bc374c96f02e64cf54af605cf52fdeb11a5eac6e7fdee

SHA512
7f948afa07244c7568450b9f5e6c3364bbfed96a090533ec8c7a8a3f226bc0a9f7660f5c90ca927bcc809653df47cab1b66477c7dc032b45aa2ea6f4be1584d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5167b0035eb3b64869713043fa5ce1ad

SHA1
b1fe85e76fac1adc2bad9003561ace9d6b228d1c

SHA256
971869a9893404b7dcdb841556365ffc9d568624aab6d6effa3f7455b74dec30

SHA512
3a95d90630fbffb8ace175d3ac5ad55bcb28f0645148f3953dc9cdd2c856aa328bb8cb8a0bc8b8cced89278bad9a9e580130f3bda848b8fbf8a661d85fe793a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c99e53624b6fa5105adfec63bdcff63

SHA1
6f2dfe2d2eb11622bfdf40bde615f732a1e13569

SHA256
3b8f053176abeeec79e8da0dbd9b0fbb106b0aae01cfbd0740e22c72ae5b621d

SHA512
dcc8d7d98be8e90751e779b6bee3f6829b0a640686667031798cd23a9f190692a431207baf6fdc7ffb8c1dd0c78f720dc22fabc766fc085c8fa65dc5cb599315

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03fa96746cbe44dbb113d21eba66467e

SHA1
3f991f156de359ab72c983ccbc871270a5e1b6db

SHA256
0a18f6dc125c96cae9706e69de5ce886110416707dc7a1fc8bf8c56fb047c573

SHA512
fba9ed2016c14fe443a8fe119debfb4c74223558f43bb32f6008b627acd6d36503695e15a3c38d7c8b25aa15b51951263fb921ff2f982dcd1cf3ab51398f9911

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22eabd35cc5c40b06b65f782760789bd

SHA1
29cbba651f7cdbbe8c77a516106b0777ccd686be

SHA256
4dcd01f1dec2924b4945eb76a40dae1e48f1c9a7743a7ec750b9495da11450a4

SHA512
36fc7128c7852e51dff1e359808ecae5a6eebcdf5d655c61b1e753db5ce89577ee9dfff5f1ee006ec638cb53e2d3d423dc29bf42002e3afc267bbca560f859de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b171e80d9c76ce6c0d217feb0f6c6092

SHA1
63104eddd0ddfda5e6ba72632dc3e7df8324fe36

SHA256
41ade757244d1456a063798ef5ed4990f5b804298a526d866c5faa740055359f

SHA512
e9bf63f12369a5f85a02b934f4aaaf233174a6b096548087f00b044855d0d28880b5ac520d37263d92441cd85d0cba8c6f2cad66aedceac1943f7e1abf36dd09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a0f976740a0b012b07e02722b92683b

SHA1
ef2233bf9274c6e35f8e2982b623f9a99532301c

SHA256
f4db28e898ac6e0a1ab93508d1d059298ad5c45766893e9aba77ec5663f55794

SHA512
b817672746083191500e7d7bbfc2e4ddc08aa76e734a4a8d1a9aa0c147a0c1bbab73738f6541ad8a2ba01ee6e2197ced6cd1d278bd0f4159f3c5b11ef2c02cce

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB03E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB0BF.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit